Một cái nhìn tổng hợp về những thách thức về con người, tổ chức và công nghệ trong quản lý an ninh công nghệ thông tin

Audestad, J. (2005), “Four reasons why 100% security cannot be achieved”, Telektronikk, Vol. 1, pp. 38‐47. Beyer, H. and Holtzblatt, K. (1998), Contextual Design, Defining Customer‐Centered Systems, Morgan Kaufmann Publishers, San Francisco, CA. Beznosov, K. and Beznosova, O. (2007), “On the imbalance of the security problem space and its expected consequences”, Information Management & Computer Security, Vol. 15 No. 5, pp. 420‐431(12). Botta, D., Werlinger, R., Gagné, A., Beznosov, K., Iverson, L., Fels, S. and Fisher, B. (2007), “Towards understanding IT security professionals and their tools”, Proceedings of the Symposium on Usable Privacy and Security (SOUPS), ACM, Pittsburgh, PA, pp. 100‐11. Chang, S.E. and Ho, C.B. (2006), “Organizational factors to the effectiveness of implementing information security management”, Industrial Management & Data Systems, Vol. 106, pp. 345‐61. Charmaz, K. (2006), Constructing Grounded Theory, Sage, Newbury Park, CA. Flechais, I. and Sasse, M.A. (2007), “Stakeholder involvement, motivation, responsibility, communication: how to design usable security in e‐science”, International Journal of Human‐Computer Studies. Garigue, R. and Stefaniu, M. (2003), “Information security governance reporting”, EDPACS, Vol. 31 No. 6, pp. 11‐17. Gonzalez, J.J., Qian, Y., Sveen, F.O. and Rich, E. (2005), “Helping prevent information security risks in the transition to integrated operations”, Telektronikk, Vol. 1, pp. 29‐37. Hawkey, K., Botta, D., Werlinger, R., Muldner, K., Gagne, A. and Beznosov, K. (2008), “Human organizational, and technological factors of IT security”, CHI'08 Extended Abstract on Human Factors in Computing Systems, Florence, pp. 3639‐44. Jiwnani, K. and Zelkowitz, M. (2002), “Maintaining software with a security perspective”, Proceedings of the International Conference on Software Maintenance, pp. 194‐203. Kankanhalli, A., Teo, H‐H., Tan, B.C. and Wei, K‐K. (2003), “An integrative study of information systems security effectiveness”, International Journal of Information Management, p. 23. Karyda, M., Mitrou, E. and Quirchmayr, G. (2006), “A framework for outsourcing IS/IT security services”, Information Management & Computer Security, Vol. 14, pp. 403‐16. Knapp, K.J., Marshall, T.E., Rainer, R.K. and Ford, F.N. (2006), “Information security: management's effect on culture and policy”, Information Management & Computer Security, Vol. 14 No. 1, pp. 24‐36. Koskosas, I.V. and Paul, R.J. (2004), “The interrelationship and effect of culture and risk communication in setting internet banking security goals”, Proceedings of the 6th International Conference on Electronic Commerce, ACM Press, New York, NY, pp. 341‐50. Kotulic, A.G. and Clark, J.G. (2004), “Why there aren't more information security research studies”, Information & Management, Vol. 41 No. 5, pp. 597‐607. Kraemer, S. and Carayon, P. (2007), “Human errors and violations in computer and information security: the viewpoint of network administrators and security specialists”, Applied Ergonomics, Vol. 38, pp. 143‐54. Pattinson, M.R. and Anderson, G. (2007), “How well are information risks being communicated to your computer end‐users?”, Information Management & Computer Security, Vol. 15 No. 5, pp. 362‐71. Rayford, B., Vaughn, R.H. Jr and Fox, K. (2001), “An empirical study of industrial security‐engineering practices”, The Journal of Systems and Software, Vol. 61, pp. 225‐32. Sandelowski, M. (2000), “Whatever happened to qualitative description?”, Research in Nursing & Health, Vol. 23 No. 4, pp. 334‐40. Straub, D.W. and Welke, R.J. (1998), “Coping with systems risk: security planning models for management decision making”, MIS Q, Vol. 22 No. 4, pp. 441‐69. Sveen, F.O., Sarriegi, J., Rich, E. and Gonzalez, J. (2007), “Toward viable information security reporting systems”, HAISA'07: Human Aspects of Information Security and Assurance, pp. 114‐27. Thomson, K. and von Solms, R. (2005), “Information security obedience: a definition”, Computers and Security, Vol. 24 No. 1, pp. 69‐75. Tsohou, A., Karyda, M. and Kokolakis, S. (2006), “Formulating information systems risk management strategies through cultural theory”, Information Management & Computer Security, Vol. 14 No. 3, pp. 198‐217. Welch, D. and Lathrop, S. (2003), “Wireless security threat taxonomy”, paper presented at: Information Assurance Workshop, IEEE Systems, Man and Cybernetics Society, pp. 76‐83. Werlinger, R., Hawkey, K. and Beznosov, K. (2008a), “Human, organizational and technological challenges of implementing IT security in organizations”, HAISA'08: Human Aspects of Information Security and Assurance, Plymouth, England, pp. 35‐48. Werlinger, R., Hawkey, K. and Beznosov, K. (2008b), “Security practitioners in context: their activities and interactions”, CHI'08 Extended Abstracts on Human Factors in Computing Systems, Florence, pp. 3789‐94. Werlinger, R., Hawkey, K., Muldner, K., Jaferian, P. and Beznosov, K. (2008c), “The challenges of using an intrusion detection system: is it worth the effort?”, Proceedings of the Symposium On Usable Privacy and Security (SOUPS), Pittsburgh, Pennsylvania, pp. 107‐16.